Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.
Incumbent rails have no public chain settlement and no public code. They are scored with the same rubric as every other row. Their low ratings show the verifiability gap between rails whose behaviour can be inspected and rails whose behaviour must be trusted; that gap is the point of the comparison, not a claim that the incumbent is unsafe.
Offered only in the countries listed. Regions: EU. Checked 2026-10-09. Not scored.
The COCA card is limited to residents of the countries listed in COCA's docs. The docs say "54 supported countries, which include" and then name 52: the 29 listed under "EEA countries" (the EU 27 plus Iceland and Norway; Liechtenstein is not named), six other European countries, ten in Asia-Pacific and seven in Latin America. The two unnamed countries are not listed here. Separately, the COCA Wallet Terms (4 November 2023) prohibit residents of named countries (Afghanistan, North Korea, DR Congo, Eritrea, Libya, Somalia, South Sudan, Sudan, Yemen, Iraq, Iran, Cuba, Syria, Mali, Central African Republic, Guinea-Bissau, Lebanon) and any UN-sanctioned country; none of those are on the card list.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Settlement token
What the balance is held in and debited from. Shown as context; it does not change any rating.
Token
Class
Issuer
Contract
USDCDefault
fiat-backed stablecoin
Circle
Conversion. The token is sold for fiat when a payment is authorised.
Fiat-backed stablecoin. An issuer holds the reserves and can freeze balances at the token contract. Value depends on the issuer redeeming at par. Censorship Resistance records whether that freeze power is disclosed.
The COCA Banking Account is a smart-contract wallet the user controls (Privy keys); at each card authorisation the wallet approves the exact amount, which is moved for settlement through COCA and its unnamed card partner. The account holds USD and EUR balances. The September 2026 update shows exchange rates as local currency per USDC, which indicates the USD balance is held in USDC; the token behind the EUR balance (funded by SEPA to the COCA IBAN) is not named in any COCA source found, so it is not listed. USDC and USDT can be deposited on many chains (NEAR, Ethereum, Arbitrum, Base, Solana, Gnosis, Polygon, Optimism, Avalanche and others); whether deposited USDT is kept as USDT or swapped into the USD balance is not stated. The chain and contract of the spending balance are not disclosed.
Checked 2026-10-12
Evidence (3)3 documented
Documented
The docs say the Banking Account is a user-controlled smart wallet and that only the authorised amount of a card payment is moved for settlement.
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Censorship Resistance
Who can block valid use, and can users route around them?
0 FailsPillar rating: weakest of 5 0 of 5 Partial or better
What would raise this pillar
Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No settlement contract could be assessed. The terms let COCA suspend or limit an individual's use at its discretion with no notice period, and the card itself is run by an unnamed third party. Anchor 0 (can target individuals with no notice).
Evidence (1)1 documented
Documented
The COCA Wallet Terms (dated 4 November 2023) let COCA terminate, suspend or limit any user's access or functionality without liability.
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Claimed
COCA's docs say a card authorization triggers the smart wallet to approve the amount, with COCA providing the "card" and "compliance rails"; no contract, ABI or chain is given.
Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs? C3
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The card flow depends on COCA's closed backend, Privy, an unnamed card program provider and issuer, and Visa. None is public or has a fallback. Closed and single-vendor, so 0.
Evidence (2)1 documented · 1 claimed
Documented
Card use is an extension provided by third-party service providers.
Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Geographic and sanctions restrictions are disclosed in the terms and docs. The settlement layer is undisclosed, so its neutrality cannot be shown. Docs only, so 1.
Evidence (2)1 documented · 1 claimed
Documented
The terms define prohibited countries (a named list plus any country sanctioned by the UN Security Council or under the user's local law).
Does the flow collect anything beyond addresses, amounts, token, and chain? P2
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Identity and location data beyond settlement needs are collected for the card and disclosed in the policy only. Disclosed in policy, so 1.
Evidence (1)1 documented
Documented
The privacy policy discloses collection of location and device data, including for AML and sanctions purposes; COCA's docs say the card is ordered with a passport, while its home page says the wallet needs no KYC.
Which third parties see a request during a payment, and can they be swapped out? P4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Third parties are disclosed by category (Privy and Morpho are named in the docs; the card issuer and KYC vendor are not). None can be swapped. No trace was run, so 1.
Evidence (1)1 documented
Documented
The privacy policy discloses sharing with service providers by category, without naming the card partner or KYC vendor.
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
? No evidence
Sets the pillar rating
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No checkable evidence settles this yet, so it counts as 0.
Security audits 2
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
Shared component: Privy shamir-secret-sharing TypeScript library (key splitting used by Privy embedded wallets) at cd8422d Assessment 27-29 June 2023. COCA says wallet keys are managed via Privy but not which Privy key scheme or library version its wallets use.
Shared component: Privy shamir-secret-sharing TypeScript library, cryptography review and code audit at 3383ad9272 Testing in February 2023 (two days). Covers only the library, not Privy's key-management service.
Unknown
1 high (polynomial degree could be below t-1), 2 info; fixes verified by Cure53
Compiled from: coca.xyz (terms, privacy) and docs.coca.xyz (all 19 pages; the Is COCA Safe page cites audits of Privy and Morpho but none of COCA's own code), the GitHub orgs and users listed in the notes (no card or wallet code), and Privy's security docs, which point to its open-source Shamir secret-sharing library and its two published reports. No audit of COCA's smart wallet, spending module or backend is published. Morpho vaults are a yield feature, not the card path. Privy's SOC 2 and its other audits (Doyensec, infrastructure) are not published as reports. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 8 evidenced, 1 attested, 0 absent, 0 not applicable, 36 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
Group A: operational facts
Fees
Evidenced
Component
Paid by
Amount
Basis
card
payer
Virtual card free; plastic card 5 USD (Starter to Standard+), free for Premium and above; no annual fee
COCA Card docs page and banking overview.
fx
none
Zero FX fees on direct pairs; other pairs not stated
Banking overview.
cashout
payer
ATM free up to 250 USD per month, then 2% (card page); the overview says free up to 200 USD
COCA Card docs page and banking overview disagree on the free allowance.
limit
none
Purchases 30,000 EUR per transaction, day and month; ATM 850 EUR per day, 5,000 EUR per month, 5 per day
COCA Card docs page.
provider
none
Crypto purchases and swaps advertised with "zero COCA fees"; third-party fees may apply
Crypto account docs; the Wallet Terms say third-party fees (card usage, DeFi, staking) are not charged by COCA.
Card top-up and IBAN transfer fees, the FX rate source, network fees for stablecoin top-ups and any card-to-card transfer fee (shown in-app per the September 2026 update) are not published. Cashback and APY are rewards, not fees, and are not recorded.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Custody model
Unknown
S1 is unknown in the provider file. COCA describes a self-custodial EIP-7702 smart wallet with Privy keys that approves each card authorization, and since COCA 3.0 (April 2026) claims it cannot access, freeze or move funds; no chain, contract or address is published, so the claim cannot be checked.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Licences and registrations
Unknown
No licence found for any party. COCA names no issuer, programme manager, IBAN provider or regulator, and calls itself a software provider. CCA Labs FZCO holds no licence stated in any COCA document. The Android app id (com.wirex.wallet) and third-party reports point at Wirex as former card infrastructure provider, but no COCA document confirms the current issuer, so no partner licence is recorded.
Documented
COCA 3.0 Q&A recap; on DAC8, COCA describes itself as a software provider.
Personal EUR IBAN since COCA 3.0 (April 2026); USD and ACH announced, not confirmed live.
ALL means every country on the card availability list in the provider file. The IBAN list omits Croatia and Cyprus, which are on the card list. Sending from COCA to other bank accounts is described in the COCA 3.0 post.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Security incidents
Unknown
Absence of a found incident is not evidence that none occurred.
No incident report found. Searched coca.xyz/news and the blog feed (monthly updates March to September 2026, COCA 3.0 post and Q&A recap) and docs.coca.xyz. No status page found.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Product changes affecting users
Evidenced
2023-11-04: COCA Wallet Terms and Privacy Notice dated (CCA Labs FZCO; card as third-party extension). source
2026-04-20: COCA 3.0 released; COCA says the infrastructure was rebuilt for full self-custody and personal EUR IBANs went live. source
2026-09-01: Updated Loyalty Program (claimable rewards, monthly claim capacity, no cashback cap). source
Private key export for the Banking section arrived in August 2026 (monthly update, archived).
Documented
COCA 3.0 announcement, 20 April 2026 (updated 23 April).
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Volume transacted (verified only)
Not verifiable
No listed contracts; the card spending contract, chain and settlement addresses are not published. COCA says it is listed on Paymentscan, a third-party card tracker; provider-reported or third-party figures are not stored.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Group B: institutional due diligence
Control
State
What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?
Attested
COCA's docs say the cards are "PCI DSS and ISO compliant" without naming the ISO standard, the certified entity, the certifier or a certificate. Whether this refers to COCA, its unnamed card programme provider or the issuer is not stated. source 1
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?
Unknown
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?
Unknown
No SOC 2 or ISAE statement for CCA Labs FZCO. COCA's docs and the COCA 3.0 post relay that its wallet-infrastructure vendor Privy is SOC 2 Type I and Type II certified; that covers Privy, not COCA, and was not checked.
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?
Unknown
No independent review of COCA's app, backend or card spending contract found. The docs cite Privy's audits (Cure53, Zellic, Doyensec) and Morpho's audits, which cover those vendors.
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?
Unknown
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?
Unknown
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?
Unknown implied from the component list
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?
Unknown
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?
Unknown implied from the component list
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?
Unknown
No customer incident-notification commitment found in the Wallet Terms, Privacy Notice or docs.
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?
Unknown
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?
Unknown
The Privacy Notice lists business continuity and disaster recovery among processing purposes; no recovery plan is published.
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?
Unknown
No public status page found (coca.xyz pages and docs read; status subdomains not probed beyond those in the provider file's notes, which did not respond).
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?
Evidenced
Login is through Privy with email, social login or device-based authentication (no seed phrase); 3D Secure is available for card payments and the card can be frozen in the app. No mandatory second factor is described. source 1
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?
Unknown
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?
Unknown
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?
Unknown
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?
Unknown
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?
Unknown implied from the component list
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?
Unknown implied from the component list
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?
Unknown implied from the component list
B5.4 Export controls If an API exports data, does it limit volumes and log exports?
Unknown implied from the component list
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?
Unknown
The Privacy Notice (dated 4 November 2023) names network and information security as a purpose but states no encryption, TLS or classification measures.
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?
Unknown
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?
Evidenced
Customer account records normally kept up to six years after the relationship ends; data of never-activated accounts may be deleted after 6 months; with transaction activity, data is kept until the user requests deletion, subject to legal duties. Erasure can be requested. See CROPS P2 for what is collected. source 1 CROPS P2
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?
Evidenced
CCA Labs FZCO states it is data controller for personal information processed in its business. International transfers rely on authority approval or contracts based on European Commission model clauses. No DPIA statement found. source 1
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?
Unknown
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?
Unknown
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?
Unknown
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?
Unknown
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?
Unknown implied from the component list
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?
Unknown implied from the component list
B9.2 CI runs on pull requests Does every pull request trigger automated checks?
Unknown implied from the component list
B9.3 Tests run in CI Do the CI workflows run the test suite?
Unknown implied from the component list
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?
Unknown implied from the component list
B9.5 Versioned releases Are releases tagged with immutable semantic versions?
Unknown implied from the component list
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?
Unknown implied from the component list
B9.7 Changelog Is a changelog maintained with the code?
Unknown implied from the component list
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?
Unknown implied from the component list
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?
Unknown
Docs describe an EIP-7702 smart wallet that approves each card authorization, Privy key management and Morpho/Gauntlet yield, but name no chain, address, card provider or issuer; no architecture document.
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?
Evidenced
CCA Labs FZCO, registered in Dubai Silicon Oasis (UAE), registration number DSO-FZCO-31557, under the COCA Wallet Terms. The card is described as a third-party extension; no card issuer or programme manager is named in any COCA document. source 1
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?
Evidenced
COCA says rewards are funded by card and payment revenue, merchant-funded offers and DeFi yield (Morpho vaults curated by Gauntlet); loyalty tiers require staking the COCA token. Plastic-card and ATM fees apply (see fees). No financial statements found. source 1
B11.3 Termination terms What happens to customer funds and data on termination by either side?
Evidenced
COCA may terminate, suspend or limit any user's use at any time without liability; if it withdraws the wallet altogether it will endeavour to give two months' notice; no refund of fees. The user can close the account. COCA says funds stay in the user's self-custodial wallet and private keys can be exported (since August 2026), so balances do not depend on COCA on termination; this is a provider claim not verified in the CROPS file (S1 unknown). source 1 · source 2
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?
Evidenced
Yes. The Privacy Notice says application decisions may be taken solely on automated checks (fraud prevention and identity data) for anti-money-laundering and fraud purposes. An AI support chat is on the 2026 roadmap (not in the payment path). source 1
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?
Evidenced
Only a rights statement is published (users have rights in relation to automated decision-making in verification); no monitoring, validation, decommissioning or bias documentation. source 1
Scope of assessment
Components in the payment path
Component
Role
Public
Licence
Operator
Required
COCA app and backend (card management, top-up, compliance)
backend
No
proprietary
CCA Labs FZCO
Yes
Card spending contract or smart-wallet module (chain and address not disclosed)
contracts
No
proprietary
COCA / card program provider
Yes
COCA smart wallet (EIP-7702 per COCA docs; keys via Privy)
wallet
No
proprietary
User (infrastructure by Privy and COCA)
Yes
Third-party card program provider and issuer (not named by COCA)
card-issuer
No
proprietary
Not disclosed
Yes
Visa (card network)
card-network
No
proprietary
Visa
Yes
KYC (passport-based; vendor not named)
kyc
No
proprietary
Not disclosed
Yes
Repositories
None found. Absence of public code is itself a finding.
Contracts
None listed.
Assessor notes
Classified as incumbent: I found no verified contract or public repository needed to run the card. Searched: coca.xyz (home, terms, privacy), docs.coca.xyz (full llms.txt index, all 19 pages; the only addresses are the COCA ERC-20 token on Polygon and Base, which is not in the card path), GitHub (users/orgs coca-xyz, cocaxyz, cocawallet, coca-wallet, coca-card, coca-finance, ccalabs, cca-labs, CCALabs: 404; coca-labs has two unrelated 2024 repos, cocalabs and cocacard are empty; code search for coca.xyz finds only third-party lists), and subdomains app., web., api., wallet., card.coca.xyz (no response). The docs say the card spends from an EIP-7702 smart wallet that approves each authorization, but give no chain, address, ABI or audit; these claims were not used to score custody. The Android app id is com.wirex.wallet, and a third-party guide says Wirex supplied the card infrastructure at launch; I found no COCA artifact linking the card to Wirex's onchain stack, so it is not evidence here. Re-assess as type card if COCA publishes the spending contract.
